Global Protect - Require Machine Cert only for Windows and MAC machines (and all other systems can just use username/password)

[mslavens]

Hi there,

I'm trying to build out a config in my lab where my global protect configuration requires a machine cert and username/password for only Windows OS and MAC OS systems and then for IOS and ANDROID devices, they will only require username/password.  My lab is running an old PA-5050 on PAN OS 8.1.23.  I'm finding that the only option is to enable a certificate profile for ALL systems and we cannot specify specific settings based on OS.

Has anyone successfully done this?

Alternatively is it possible to configure multiple gateways on the same edge and then use the portal 'agent configuration' to redirect to different gateways that enforce different certificate profiles?

I'm also looking at options on PAN OS 9.1.X.

Thank you,

Michael

[dmifsud]

Hi Michael,

The Certificate profile config is indeed for all operating systems, but at least in 9.1 the "Allow Authentication with User Credentials OR Client Certificate" setting can be configured per operating system. You could have it like this for example:

Cert profile: configured for all
OS Windows: Allow Authentication with User Credentials OR Client Certificate = NO

OS Android: Allow Authentication with User Credentials OR Client Certificate = YES

This should result in Windows needing a Client Cert + User Credentials, but Android would need only one or the other.

Your second option is also valid. You can use OS in the Config Selection Criteria of the Portal to give a different Portal config to different OS's, and those different Portal configs send them to different Gateways which have different cert profile configs.

- DM